Behavioral task
behavioral1
Sample
1440-64-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1440-64-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1440-64-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
5e4fec74ceab4960200a9fee1a27372b
-
SHA1
bd7917874ff686e95be31f45a172bb62c3c671ab
-
SHA256
8dec5e061a11888ea33bb82e936ea7c8edcf7a886fa33eeda9a67fb501882401
-
SHA512
541dda09071ac57f8d710e93f5b44ce807670edd010c1ab4497e1e5c54cf32b86894047febf3ecc8cd437c2b9106d63a55ca885dd54cd81275d1af995e0e19a2
-
SSDEEP
1536:YvZi55zWaCDfjzo9eTACp3OVFi4MRO91ttttttttttttttttttttttttttttttt:YxqZWXTaQAYO7EROUqcwPh2eco97hd
Malware Config
Extracted
redline
19.01 For SEO Site
88.218.171.68:20005
-
auth_value
662a408713be565c664589524e238f8c
Signatures
-
Redline family
Files
-
1440-64-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ